authenticationSigningKey property

Future<ApkamSigningKeys?> get authenticationSigningKey

The APKAM authentication keypair as a signing key: the keyfile's for enrollmentId — typed material first, the flat pair as rsa2048 otherwise — or null when it holds neither.

Two jobs, one key, for as long as an enrollment holds no signing material of its own: it authenticates the connection and it signs what the enrollment attests to. Once signing keys exist it stops doing the second job and drops out of the advertisement entirely (apskEntries) — safe because a credential whose posture wants a stronger authentication algorithm retrofits into a new enrollment rather than reclassifying this key, so the old enrollment's record keeps verifying what this key signed.

Implementation

Future<ApkamSigningKeys?> get authenticationSigningKey async {
  final fromKeyfile = (await _readKeyfile('authentication key'))
      ?.authenticationKeyPairFor(enrollmentId);
  if (fromKeyfile == null) return null;
  return ApkamSigningKeys(
    algorithm: fromKeyfile.algorithm,
    publicKey: fromKeyfile.publicKey,
    privateKey: fromKeyfile.privateKey,
  );
}